# Mengya Drift Bottle – Backend

Flask API that powers the React frontend located in `../mengyadriftbottle-frontend`.

## Features

- JSON-first `/api` endpoints for throwing, picking up, and reacting to bottles
- Rate limiting per IP (5 seconds) for throw/pickup actions
- File-backed persistence with automatic schema upgrades
- Lightweight token portal via `/admin?token=...` for quick moderation
- Full legacy dashboard (`/admin/login`) preserved for session-based moderation
- CORS enabled for local development via Vite

## Quick Start

```bash
cd mengyadriftbottle-backend
python -m venv .venv
.venv\Scripts\activate
pip install -r requirements.txt
python app.py
```

The server listens on `http://localhost:5002` by default and exposes the API under `http://localhost:5002/api`.

## Environment Variables

| Name | Description | Default |
| ---- | ----------- | ------- |
| `DRIFT_BOTTLE_SECRET` | Secret key for Flask sessions | Random value generated at runtime |
| `DRIFT_BOTTLE_ADMIN_TOKEN` | Token required for `/admin?token=...` | `shumengya520` |

## File Storage

Bottle data, config, mottos, and filter words continue to use the JSON files located at the repository root (`../bottles.json`, etc.). The backend automatically creates them if missing.